Diagnose first. Never autofix.

dc-doctor is the day-2 diagnostic. It never creates, starts, stops, or removes containers. It never edits .devcontainer or shell rc.

dc-doctor                 # this folder
dc-doctor ~/src/app
dc-doctor --json          # one JSON document on stdout

Exit	Meaning
0	usable (warnings allowed)
1	one or more blockers
2	invalid invocation only (unknown flag, not a directory)

Checks are a closed list of 19 ids (bash, common library, Docker, Colima, official CLI, workspace path, duplicate labels, stack, desired/actual ports, required networks, stale owned sidecars, disk, dc-cli version/channel/update). docker_context is engine + socket + extra live engines — not the context name alone. Two live daemons is a blocker (error.code=split_brain). Two paths to the same daemon (inode, Colima default dual sock, or matching docker info ID) are one engine. Human output prints a Fix block on split. dc-engine --fix prints the same recipe; --yes only runs docker context use. Doctor never creates a network. Doctor never starts or stops an engine. dc_cli_update warns when a newer GitHub release exists (dc upgrade); offline stays ok.

When a qualified floor is recorded in docs/qualification/devcontainer-cli-floor.md, a present CLI below that floor is a blocker. The floor is unpublished in v0.8.0 — doctor reports the installed version and does not invent a minimum.

Run this before dc-prune --yes, dc-up --take-ports, or dc-up when the machine also has Docker Desktop.

Stuck after this: dc-recover.